VPS Tutorials
Cloudflare CDN Setup (2025) - Free Global Speed Boost
The complete 2025 guide to configuring Cloudflare's free CDN. Learn how to correctly set up DNS proxying, SSL modes and cache rules to make your VPS website several times faster.
If your VPS is in the US, Chinese users need 3 seconds to open it, while European users load it instantly; or your small website gets knocked out by DDoS attacks at the drop of a hat...
No surprises here: it's time to bring in Cloudflare.
Cloudflare is the world's largest free CDN provider. It caches your website content across 300+ edge nodes worldwide, so users fetch data from the server closest to them. It also blocks most small-scale DDoS attacks for free and gives you a permanently free SSL certificate.
This article walks you through configuring Cloudflare correctly, step by step, squeezing every drop of performance out of the free plan.
- Visit cloudflare.com and register an account.
- Click
Add a siteand enter your domain (e.g.example.com). - Choose the Free plan (big spenders can pick Pro).
- Cloudflare automatically scans your existing DNS records; confirm they're correct and continue.
- Key step: Go to your domain registrar (e.g. Namesilo, GoDaddy) and change the domain's Nameservers to the two addresses Cloudflare provides (e.g.
xxxx.ns.cloudflare.com). - Wait for DNS to take effect (usually anywhere from a few minutes to 24 hours). Once it does, the Cloudflare dashboard will show
Active.
On the Cloudflare DNS settings page, you'll see an orange or grey "cloud" icon next to each A/CNAME record.
- Orange cloud (Proxied): Traffic goes through Cloudflare's global network and gets CDN acceleration, DDoS protection and SSL. Recommended: turn it on.
- Grey cloud (DNS Only): Cloudflare acts only as a DNS resolver and provides no acceleration or protection.
Note: Mail-related records (MX records) must stay grey, otherwise email sending and receiving will break.
This is where beginners most often trip up. Go to SSL/TLS > Overview and you'll see 4 encryption modes:
| Mode | Meaning | Recommendation |
|---|---|---|
| Off | No encryption at all, completely exposed | ❌ |
| Flexible | User-to-Cloudflare is encrypted, CF-to-your-VPS is not | ⚠️ Only for temporary debugging |
| Full | Encrypted end to end, but origin certificate is not verified | ⚠️ Makeshift |
| Full (Strict) | Encrypted end to end, and origin certificate validity is verified | ✅ Strongly recommended |
How to enable Full (Strict)? Your VPS origin must have a valid SSL certificate installed. The simplest way:
- In the Cloudflare dashboard, go to SSL/TLS > Origin Server.
- Click
Create Certificateto generate a Cloudflare Origin CA certificate (validity selectable up to 15 years). - Copy the certificate and private key to your VPS and configure Nginx/Apache to use them.
When done, switch the mode to Full (Strict).
Go to Caching > Configuration:
- Caching Level: Set to
Standard(default). - Browser Cache TTL: We recommend
1 month, so returning visitors don't re-download CSS/JS/images. - Always Online: Turn it on! When your VPS goes down, Cloudflare shows the cached static page so users don't see a 502 error.
Go to Caching > Cache Rules to create custom rules:
- Cache static assets longer: Match URL
*example.com/wp-content/uploads/*and set Edge TTL to 1 month. - Bypass dynamic pages: Match URL
*example.com/wp-admin/*or*example.com/cart/*and set toBypass Cache, so the admin panel and shopping cart are never cached incorrectly.
Go to Speed > Optimization and enable the following:
- Auto Minify: Strips extra whitespace and comments from HTML/CSS/JS.
- Brotli: A stronger compression algorithm than Gzip, reducing transfer size.
- Early Hints (103): Tells the browser which resources it can preload before the server returns the full HTML.
Even with Cloudflare enabled, determined people may still find your real VPS IP through historical DNS records or email headers, then bypass Cloudflare and attack you directly.
Solution: Cloudflare Tunnel (formerly Argo Tunnel)
This is a safer approach: you run a small program called cloudflared on your VPS, which actively connects to Cloudflare's network, completely hiding your origin IP.
Setup reference in the official docs: Cloudflare Tunnel | Cloudflare Docs
Cloudflare's free plan is already powerful enough to make your VPS website several times faster worldwide, while also giving you free DDoS protection and an HTTPS certificate. Spend 15 minutes on the configuration in this article and your website experience can rival enterprise solutions costing millions.
Pro Tip: If you find things get slower after configuration (especially in mainland China), it may be because Cloudflare's free plan has no nodes in mainland China. In that case, consider CNAME setup, or use DNSPod together with Cloudflare for split DNS resolution: mainland China users connect directly to the origin, while overseas users go through the CDN.